1-in[.]apac2[.]coinbase[.]com[.]ph

This domain, 1-in.apac2.coinbase.com.ph, is actively flagged as a high-risk phishing site impersonating Coinbase, a cryptocurrency exchange platform. Analysis indicates the domain is currently resolving to 208.91.196.145 and is hosted under ASN 23470. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains. The page title, 'Privacy error,' suggests an attempt to mimic browser security warnings, potentially to deceive users into bypassing security prompts or entering credentials. The domain appears on one security blocklist and is flagged by Google Safe Browsing for social engineering. Eleven of 95 security vendors on VirusTotal have detected this domain as malicious, reinforcing its classification as a phishing threat. Infrastructure analysis reveals the domain was registered through a provider associated with NET-172-93-103-96-29, though no specific registration date or additional hosting details are available. The domain remains active as of July 12, 2026. Defenders should treat this domain as a confirmed phishing threat targeting Coinbase users. Immediate actions include blocking the domain and its resolving IP at the network level, updating endpoint protection rules, and monitoring for user interactions with the domain. The lack of additional context about the phishing kit or exact content served limits further technical attribution, but the combination of brand impersonation, social engineering flags, and vendor detections provides sufficient evidence for mitigation. No evidence suggests this domain is part of a broader campaign, but defenders should correlate with other Coinbase-themed phishing domains for potential patterns.